POPIA only applies to personal information that has been “entered in a record”

A “record” can be just about any known format, including writing (on any material), taping, recording, labelling, drawing, and photographing. Don’t worry, this does not include personal information you have stored in your brain – you are still free to process your own memories, even those that contain very personal information about other people ;-) “Entering in a record” is not necessarily the same thing as “creating” – transferring existing personal information to a database, for example, is covered by the definition of “entering into a record”.

POPIA makes a further distinction between “automated” and “non-automated” means of entering a record. Only in the case of non-automated entering does POPIA require that the information forms part (or is intended to form part) of a structured “filing system” (some kind of list, record or database).

POPIA does not apply to personal information collected for personal or household purposes, or for journalistic, literary or artistic purposes.

POPIA definition

3. (1) This Act applies to the processing of personal information— (a) entered in a record by or for a responsible party by making use of automated or non-automated means: Provided that when the recorded personal information is processed by non-automated means, it forms part of a filing system or is intended to form part thereof.

Record means any recorded information-
(a) regardless of form or medium, including any of the following:

  • (i) Writing on any material;
  • (ii) information produced, recorded or stored by means of any tape-recorder, computer equipment, whether hardware or software or both, or other device, and any material subsequently derived from information so produced, recorded or stored;
  • (iii) label, marking or other writing that identifies or describes any thing of which it forms part, or to which it is attached by any means;
  • (iv) book, map, plan, graph or drawing;
  • (v) photograph, film, negative, tape or other device in which one or more visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced;

(b) in the possession or under the control of a responsible party;
(c) whether or not it was created by a responsible party; and
(d) regardless of when it came into existence;

Filing system means any structured set of personal information, whether centralised, decentralised or dispersed on a functional or geographical basis, which is accessible according to specific criteria;

Automated means, for the purposes of [section 3], means any equipment capable of operating automatically in response to instructions given for the purpose of processing information.

POPIA The Protection Of Personal Information Act